Privacy Policy

1. Who We Are

Allergen Maps LLC ("AllergenMaps," "we," "us," or "our") operates the AllergenMaps website and related services (the "Service"). We are an Indiana limited liability company. Privacy and legal inquiries may be directed to legal@allergenmaps.org. For general questions, reach us at privacy@allergenmaps.org.

2. What This Policy Covers

This Privacy Policy describes the information we collect when you use the Service, how we use it, and the choices you have. The Service is intended for healthcare professionals and is currently in beta; access requires an invitation code and a registered account. Searching medications, viewing medication detail, and comparing products require you to sign in. Public pages, such as our education content, can be read without an account.

This policy does not cover the AllergenMeds mobile app, which has its own privacy policy and consumer health data notice.

3. Information We Collect

Information you provide

• Account information: when your account is created, your name, email address, and the professional details you provide (such as NPI verification and pharmacy details). Your password is stored by our authentication provider in hashed form.
• AI assistant questions: where the AI assistant is available to your account, the questions you type and the answers you receive are stored with your account. To generate an answer, your question and the related medication and ingredient context are sent to the AI service providers listed in section 7. Do not enter patient names, dates of birth, record numbers, or any other patient identifier into the assistant.
• Case reports: adverse event reports you submit, which may be submitted without an account. Do not include patient identifiers.
• Contact form submissions: your name, email address, and message when you contact us through the site.
• Survey responses: if you complete the beta survey, your responses are stored to help us improve the Service.
• Issue reports: details you submit via the "Report Issue" feature.
• API registration: organization name and email address for developers who request API access.

Information collected automatically

• Server logs: our hosting provider (Vercel) automatically records standard web server logs including IP address, browser type, pages visited, and request timestamps. These logs are used for security monitoring and performance analysis.
• Partner API request log: for API key holders, we log the endpoint called, request parameters, response time, status code, and request IP address to enforce usage limits and detect abuse. Logs do not include patient-identifiable information.
• Access audit log: for signed-in use of the Service, we record the endpoint accessed, a timestamp, your account identifier, and the request IP address in our own systems for security monitoring and account-integrity checks. These records are deleted after 90 days.
• Usage events: interaction events such as searches performed, medication pages viewed, filter selections made, and compare views initiated. Events carry a per-browser-session identifier and, when you are signed in, your account identifier, so that we can understand how the Service is used per account and, for organization-provisioned accounts, per organization. Search text is truncated to 60 characters at the point of storage as a safeguard against free-form text. Activity from our own staff and from pre-release environments is flagged and excluded from our metrics.
• Acquisition source: when you sign up for an account or request an API key, the request includes the arrival record kept in your browser (see Local browser storage below): the campaign tags on the link you followed, the referring site's domain, which social app's built-in browser was used, which ad-click marker was present (its name only, never its value), and the page you first landed on and when. We store it with the new account or API key. It contains no advertising identifier and no full referring address.

Local browser storage

We use your browser's localStorage and sessionStorage to support site functionality. None of these values are transmitted to our servers except where explicitly noted. No cookies are set by AllergenMaps for tracking or advertising purposes.

localStorage (persists across sessions):

• A flag recording that you have accepted our Terms of Use
• Your allergen and dietary filter selections, if you configure them via the filter panel (stored so your preferences persist across visits)
• A record of how you first and most recently arrived at the site: the campaign tags on the link, the referring site's domain, which social app's built-in browser was used, which ad-click marker was present (never its value), and the page you landed on and when. It is kept for 90 days and sent with a sign-up or API key request so it can be stored with the new account or API key (see Acquisition source above)

sessionStorage (cleared when the tab closes):

• A randomly generated session identifier used to group usage events within a single browsing session. The identifier itself is random; when you are signed in, the same events also carry your account identifier (see Usage events above)
• The same kind of arrival record for the current visit (campaign tags, referring domain, built-in browser, ad-click marker name, landing page and time). It is sent only with a sign-up or API key request, as described above

Authenticated users of the admin panel or PMS demo interface have additional short-lived session tokens stored in localStorage and sessionStorage as part of those authenticated workflows. These are not present on public-facing pages.

4. How We Use Information

We use the information described above to:

• Improve the accuracy, coverage, and usability of the Service
• Respond to contact form inquiries and issue reports
• Administer API access and enforce usage terms
• Monitor for abuse, security threats, and technical issues
• Understand aggregate usage patterns (e.g., most-searched medications)
• Understand which channels (for example, a social platform, a search engine, or a partner site) lead to sign-ups. The acquisition source stored with an account or API key is shown to our team alongside that account

Legal basis for processing (GDPR)

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Contact form submissions & issue reports: Legitimate interest (responding to user inquiries and improving the Service)
• Survey responses: Consent (you voluntarily opted in and explicitly confirmed consent before submitting)
• API registration data: Contract performance (necessary to fulfill the API Terms of Service you agreed to)
• Server logs & API audit logs: Legitimate interest (security monitoring, abuse detection, and service reliability)
• Usage events: Legitimate interest (understanding how the Service is used and improving it; events from signed-in sessions are associated with the account)
• Acquisition source: Legitimate interest (understanding which channels lead to sign-ups, so we can direct our outreach to healthcare professionals)

5. What We Do Not Do

• We do not sell, rent, or share personal information with third parties for marketing purposes
• We do not use third-party tracking, advertising identifiers, or cross-site profiling of any kind. Signed-in product usage is associated with your account solely to operate and improve the Service
• We do not serve targeted advertising
• We do not collect Protected Health Information (PHI) as defined under HIPAA

6. Health Information and HIPAA

AllergenMaps is an informational reference tool and is not a HIPAA Covered Entity or Business Associate. We do not collect, store, or process Protected Health Information (PHI).

Please do not submit patient names, medical record numbers, health plan identifiers, or any other PHI through the Service, including in the AI assistant, case reports, or any other free-text field. The allergen selections and medication searches you perform are not associated with any patient identity in our systems.

If you are a healthcare provider using the Service or API to support clinical workflows, you are solely responsible for ensuring your use complies with applicable HIPAA requirements within your own systems.

7. Third-Party Service Providers

We use the following third-party services to operate the Service:

• Vercel: web hosting and deployment. Vercel may log standard server request data, including IP addresses. Vercel Web Analytics and Speed Insights measure page views and page performance.
• Supabase: database and authentication. Account information, AI assistant conversations, case reports, survey responses, contact form data, API key information, usage events, and the logs described in section 3 are stored in Supabase-hosted infrastructure.
• Cloudflare: DNS for our domains, and Email Routing, which receives and forwards email sent to our @allergenmaps.org addresses (including privacy and legal requests). Cloudflare also serves our status page.
• Upstash: rate limiting. Request IP addresses and account identifiers are used as short-lived counter keys to enforce usage limits.
• Google: Gmail sends our transactional email (the recipient address and the message). The Gemini API converts AI assistant questions into search embeddings used to find relevant reference material.
• Resend: email delivery (the recipient address and the message).
• OpenRouter (routing to DeepSeek) and Anthropic: generate AI assistant answers. They receive the questions you type and the related medication and ingredient context. Anthropic is a standby provider and receives questions only when it is the active provider.
• TypeSafe: search assistance. When you search, the search text you type (not your name, email address, or account identifier) is sent to TypeSafe to help resolve and rank results.
• Instatus: our public status page. If you subscribe to status updates, Instatus receives your email address.
• Sentry: error monitoring in production. When an application error occurs, Sentry captures the error details to help us diagnose and fix issues. Error reports are automatically scrubbed to remove authorization headers, cookies, and API keys before transmission. Legal basis: legitimate interest (maintaining service reliability and diagnosing errors). Sentry retains error event data for approximately 90 days.
• Stripe: payment processing for provider subscriptions. When you subscribe, you enter your payment details directly with Stripe at checkout; Stripe receives your name, email address, and card information and manages the recurring charges. We never receive or store your full card number; we store only the customer and subscription identifiers Stripe assigns and your subscription status. Stripe processes this data under its own data processing terms. Legal basis: performance of a contract (operating your paid subscription).
• RevenueCat: subscription management for the AllergenMeds mobile app only, as described in the app's own privacy policy. It is not used by the AllergenMaps website.

These providers process data on our behalf under their own privacy and security terms. We do not authorize them to use your data for their own purposes beyond providing services to us.

8. Data Retention

We retain information for the following periods:

• Account information: Kept while your account is active, and deleted when you ask us to delete your account
• Access audit log (signed-in use): 90 days, then deleted automatically
• Partner API request log (API key holders): 365 days, then deleted automatically
• Usage events: Raw events are kept for 90 days and then deleted automatically. Aggregated daily statistics (counts per day, with no individual-level rows) are kept indefinitely
• AI assistant conversations: Deleted 90 days after the last message in the conversation (365 days for our staff's internal assistant), and then permanently purged 90 days later
• Administrative action log (staff accounts only): At least 2 years, for security and accountability
• Server logs (Vercel): Up to 90 days for security and operational purposes
• Contact form submissions & issue reports: Up to 2 years, or until deletion is requested
• Survey responses: Retained to track feedback trends; you may request deletion at any time
• API registration data: Retained while your API access is active, and afterward until you request deletion
• Browser localStorage & sessionStorage: Persists in your browser until you clear it (the arrival record is removed after 90 days); this data is stored only on your device and is not transmitted to our servers (except where explicitly noted in §3)

To request deletion of information you submitted, contact us at legal@allergenmaps.org.

9. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children. By using the Service, you represent that you are at least 13 years of age.

If you are a parent or guardian and believe your child under 13 has submitted personal information to us (such as through the contact form or beta survey), please contact us at legal@allergenmaps.org and we will promptly delete it.

10. Your Privacy Rights

California Residents (CCPA)

Under the California Consumer Privacy Act, California residents have the right to:

• Know what personal information we have collected about you and how it is used
• Delete personal information we have collected from you (with certain exceptions)
• Opt out of sale: we do not sell personal information, so no opt-out is required
• Non-discrimination: we will not discriminate against you for exercising your rights

EU / EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you may have the following rights regarding personal data we hold about you:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate personal data
• Erasure: request deletion of your personal data ("right to be forgotten")
• Restriction: request that we limit processing of your personal data in certain circumstances
• Objection: object to processing based on legitimate interests

To exercise any of these rights, contact us at legal@allergenmaps.org. We will respond within 30 days. Because use of the Service is tied to your account, we can locate the records linked to it: your account information, usage events and logs that carry your account identifier, AI assistant conversations, and information you submitted (such as contact form messages and survey responses).

Limitations on erasure: The right to erasure does not apply to data that cannot be linked to your identity, such as aggregate statistics. Security logs that contain IP addresses (the access audit log, kept 90 days, and the partner API request log, kept 365 days) are retained for security and abuse monitoring, and deleting individual entries within those periods may not be technically feasible. We will always delete your account information, AI assistant conversations, and explicitly submitted data (contact form, survey responses, API registration) upon verified request.

11. Data Breach Notification

If we confirm a security breach that results in unauthorized access to personal data we hold, we will notify affected individuals and relevant authorities in compliance with applicable law:

• EU/EEA residents (GDPR): We will notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals (per GDPR Art. 33). We will notify affected individuals without undue delay where the breach is likely to result in high risk (per GDPR Art. 34). Notifications will describe the nature of the breach, its likely consequences, and any recommended protective measures.
• California residents (CCPA): We will notify affected residents in the most expedient time possible and without unreasonable delay.
• Other users: We will provide reasonable notice as required by applicable state law.

Notifications will be sent to the email address on your account or the one you provided (e.g., via contact form or API registration), where applicable. For questions about data security, contact legal@allergenmaps.org.

12. Updates to This Policy

We may update this Privacy Policy as the Service evolves. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For questions, concerns, or data deletion requests regarding this Privacy Policy, contact: